When two incidents are merged in Cortex XSIAM, data and custom field values from the source (secondary) incident are not always automatically carried over to the destination (primary) incident, which is why an analyst can report missing details afterward. The reliable way to recover that information is to unmerge the incidents, which restores the original incidents together with their individual fields and context so the missing details can be retrieved and copied into the incident notes. Checking the destination War Room (A) or a child incident (D) will not surface fields that failed to transfer, and simply examining the source context (B) is not the prescribed remediation to restore the merged data.
Community Discussion